24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T469,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 453cf7c56790… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 453cf7c56790…. Malware family: Malware. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba"],"about":{"@type":"SoftwareApplication","name":"iconpack.ico","applicationCategory":["peexe","executable"],"identifier":"453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc13,"" wrote bytes "7f5a1b7500000000" to virtual address "0x00452424" (part of module "453CF7C567906715AC1E59D221CB671D6CAF75FD399583CC8978CAB8B6B20ABA.EXE") "" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "" wrote bytes "0a0000a188b84400" to virtual address "0x00415184" (part of module "453CF7C567906715AC1E59D221CB671D6CAF75FD399583CC8978CAB8B6B20ABA.EXE") "" wrote bytes "5f3c0977ad370977e72f0977b23a09778a6a097718390977dd6b097773760a775ba009778b2d097731b10977843009778b2d09770e6b097789690977016f0977b64109779d440977b83e097700000000" to virtual address "0x004526B4" (part of module "453CF7C567906715AC1E59D221CB671D6CAF75FD399583CC8978CAB8B6B20ABA.EXE") "" wrote bytes "c0727575ad73757588687575aa6e7575145f75753ba27575df5d757540667575066975757d07767500000000" to virtual address "0x0045242C" (part of module "453CF7C567906715AC1E59D221CB671D6CAF75FD399583CC8978CAB8B6B20ABA.EXE") "" wrote bytes "dd91ad754edfad7566dfad757edfad7536dfad7524e1ad759d46ae75fe40ae7531cfad758114ae75c846ae75cc48ae750749ae758d46ae75ef48ae75ad46ae75d614ae7500000000" to virtual address "0x004523DC" (part of module "453CF7C567906715AC1E59D221CB671D6CAF75FD399583CC8978CAB8B6B20ABA.EXE") "" wrote bytes "241c377641e12d7600000000" to virtual address "0x00452618" (part of module "453CF7C567906715AC1E59D221CB671D6CAF75FD399583CC8978CAB8B6B20ABA.EXE") "iCLS.exe" wrote bytes "7f5a1b7500000000" to virtual address "0x00452424" (part of module "ICLS.EXE") "iCLS.exe" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "iCLS.exe" wrote bytes "0a0000a188b84400" to virtual address "0x00415184" (part of module "ICLS.EXE") "iCLS.exe" wrote bytes "92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL") "iCLS.exe" wrote bytes "5f3c0977ad370977e72f0977b23a09778a6a097718390977dd6b097773760a775ba009778b2d097731b10977843009778b2d09770e6b097789690977016f0977b64109779d440977b83e097700000000" to virtual address "0x004526B4" (part of module "ICLS.EXE") "iCLS.exe" wrote bytes "c0727575ad73757588687575aa6e7575145f75753ba27575df5d757540667575066975757d07767500000000" to virtual address "0x0045242C" (part of module "ICLS.EXE") "iCLS.exe" wrote bytes "dd91ad754edfad7566dfad757edfad7536dfad7524e1ad759d46ae75fe40ae7531cfad758114ae75c846ae75cc48ae750749ae758d46ae75ef48ae75ad46ae75d614ae7500000000" to virtual address "0x004523DC" (part of module "ICLS.EXE") "iCLS.exe" wrote bytes "241c377641e12d7600000000" to virtual address "0x00452618" (part of module "ICLS.EXE")26:T6c1,Found malicious artifacts related to "216.146.38.70" (ASN: , Owner: ): ... URL: http://216.146.38.70/ (AV positives: 1/65 scanned on 08/19/2017 02:55:55) URL: http://216.146.38.70:8245/ (AV positives: 1/65 scanned on 06/29/2017 08:10:54) URL: http://checkip.dyndns.org/ (AV positives: 1/65 scanned on 05/03/2017 00:18:33) URL: http://ip-addr.es/ (AV positives: 1/68 scanned on 12/06/2016 20:42:09) URL: http://checkip.dyndns.org/?rnd1=31474.5052339861 (AV positives: 1/68 scanned on 11/07/2016 21:08:26) File SHA256: 502d2ef1ab10cffe80b1f1ee3e97377d671e5100329c1a5c1c3ea6b5d6998f3e (AV positives: 54/65 scanned on 09/20/2017 13:41:37) File SHA256: d6fcfea0feebbd5ac239eeb20afc46fe96c4a1611964d41e7d49b95ee16eeddd (AV positives: 55/65 scanned on 09/20/2017 11:37:11) File SHA256: 275a982bb5b62e74a49a142dd4abeb042db064f5c34aeb764a0512494503d887 (AV positives: 55/65 scanned on 09/20/2017 11:09:09) File SHA256: 36ea23fc5c16abb32becdd8a9b4216ed324d2b387f9607b6a2f9f507486abc97 (AV positives: 56/64 scanned on 09/20/2017 10:57:05) File SHA256: 8d5a112659d74e4fc4ddfde270e9671829a9919ffe15f8b0846aa5a91691a2f0 (AV positives: 52/65 scanned on 09/20/2017 09:18:26) File SHA256: 3a56a3a2d25bb231071f61fae8ba188da50e69840de115f321909765c0a0c129 (Scanned on 08/30/2017 15:43:03) File SHA256: ca29bd44fc1c4ec031eadf89fb2894bbe646bc0cafb6242a7631f7404ef7d15c (Scanned on 08/29/2017 20:01:22) File SHA256: c9f2680609389882d72201597f0ea3cc6f0f7ebe259666acf31ba6904c1b3961 (Scanned on 08/28/2017 00:25:24) File SHA256: 72a1ec84c916a4e0bc96ea38089c23a5eac349305bf3e04cf9f325a6069fbb8e (Scanned on 08/26/2017 18:59:37) File SHA256: a49011e3d4cf2e520659bcd2eb2d7d1f642c0cddfedd757f872cc24c8053ab64 (Scanned on 08/26/2017 13:23:43)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791264918779,"unified_at":"2026-10-06T05:35:18.779Z","metadata":{"hashes":{"sha256":"453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba","sha1":"daadde3835ab299aec5e6edf762b80dd9128e2d8","md5":"796e62cc921af203c2dae93159f93f70","sha512":"603f72ccb33e1be1ca6e98a290b203fa9a9bbbe9dd832e34cf800a056011ee191a0357ca44d452862345b35dbb7b28689dc6e47eeeed4a54d54497c78d7c2097","ssdeep":"12288:KcGwPaYCj9w6G/2V6K7tk78C4grsr1AX3seNBKTr9TWLdBz0yBc2REYus:KcGwSfj9nltk7qesrk3seNETruwk0s","ssdeep_chunks":["12288:KcGwPaY","12288:cGwPaYC","12288:GwPaYCj","12288:wPaYCj9","12288:PaYCj9w","12288:aYCj9w6","12288:YCj9w6G","12288:Cj9w6G/","12288:j9w6G/2","12288:9w6G/2V","12288:w6G/2V6","12288:6G/2V6K","12288:G/2V6K7","12288:/2V6K7t","12288:2V6K7tk","12288:V6K7tk7","12288:6K7tk78","12288:K7tk78C","12288:7tk78C4","12288:tk78C4g","12288:k78C4gr","12288:78C4grs","12288:8C4grsr","12288:C4grsr1","12288:4grsr1A","12288:grsr1AX","12288:rsr1AX3","12288:sr1AX3s","12288:r1AX3se","12288:1AX3seN","12288:AX3seNB","12288:X3seNBK","12288:3seNBKT","12288:seNBKTr","12288:eNBKTr9","12288:NBKTr9T","12288:BKTr9TW","12288:KTr9TWL","12288:Tr9TWLd","12288:r9TWLdB","12288:9TWLdBz","12288:TWLdBz0","12288:WLdBz0y","12288:LdBz0yB","12288:dBz0yBc","12288:Bz0yBc2","12288:z0yBc2R","12288:0yBc2RE","12288:yBc2REY","12288:Bc2REYu","12288:c2REYus","24576:KcGwPaY","24576:cGwPaYC","24576:GwPaYCj","24576:wPaYCj9","24576:PaYCj9w","24576:aYCj9w6","24576:YCj9w6G","24576:Cj9w6G/","24576:j9w6G/2","24576:9w6G/2V","24576:w6G/2V6","24576:6G/2V6K","24576:G/2V6K7","24576:/2V6K7t","24576:2V6K7tk","24576:V6K7tk7","24576:6K7tk78","24576:K7tk78C","24576:7tk78C4","24576:tk78C4g","24576:k78C4gr","24576:78C4grs","24576:8C4grsr","24576:C4grsr1","24576:4grsr1A","24576:grsr1AX","24576:rsr1AX3","24576:sr1AX3s","24576:r1AX3se","24576:1AX3seN","24576:AX3seNB","24576:X3seNBK","24576:3seNBKT","24576:seNBKTr","24576:eNBKTr9","24576:NBKTr9T","24576:BKTr9TW","24576:KTr9TWL","24576:Tr9TWLd","24576:r9TWLdB","24576:9TWLdBz","24576:TWLdBz0","24576:WLdBz0y","24576:LdBz0yB","24576:dBz0yBc","24576:Bz0yBc2","24576:z0yBc2R","24576:0yBc2RE","24576:yBc2REY","24576:Bc2REYu","24576:c2REYus","12288:KcGwSfj","12288:cGwSfj9","12288:GwSfj9n","12288:wSfj9nl","12288:Sfj9nlt","12288:fj9nltk","12288:j9nltk7","12288:9nltk7q","12288:nltk7qe","12288:ltk7qes","12288:tk7qesr","12288:k7qesrk","12288:7qesrk3","12288:qesrk3s","12288:esrk3se","12288:srk3seN","12288:rk3seNE","12288:k3seNET","12288:3seNETr","12288:seNETru","12288:eNETruw","12288:NETruwk","12288:ETruwk0","12288:Truwk0s"],"imphash":"15aa247c811e2067ab242bb4f06f9434"},"file_info":{"file_name":"iconpack.ico","file_type":["peexe","executable"],"file_type_id":"exe","file_size":654336,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1505915393000,"last_seen":1677365117000,"last_multi_scan":1677365117000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":8,"malicious_count":5,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.fhcbt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.AgentWDCR.MIO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.VFJF-6108","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Weecnaw (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Weecnaw.K trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 0051ad7d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.ispk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.adk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.RansomKD.euuhuk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Elenoocka-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Banker.CGU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Yakes.Win32.65757","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO DYNAMIC_DNS Query to *.dyndns. Domain\" (SID: 2012758, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.49.68.192:443\"\n \"216.146.38.70:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nHost: checkip.dyndns.org\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"\"/c copy \"%APPDATA%\\Intel\\iCLS.exe+\" \"%APPDATA%\\Intel\\iCLS.exe\"\"\" on 2017-9-20.14:42:13.500","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"\"/c copy \"%APPDATA%\\Intel\\iCLS.exe+\" \"%APPDATA%\\Intel\\iCLS.exe\"\"\" (UID: 00018234-00002860)\n Spawned process \"iCLS.exe\" (UID: 00018236-00002968)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"iCLS.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"20-09-2017\" has type \"data\"\n \"default.conf\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"iCLS.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"iCLS.exe\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"iCLS.exe\" touched file \"%WINDIR%\\system32\\en-US\\USER32.dll.mui\"\n \"iCLS.exe\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"GET / HTTP/1.1\nHost: checkip.dyndns.org\"\n Heuristic match: \"checkip.dyndns.org\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data\n .data with unusual entropies 7.86984001031\n 7.86984001031","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"iCLS.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"iCLS.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"iCLS.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"iCLS.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ICLS\"; Value: \"%APPDATA%\\Intel\\iCLS.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"iCLS.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetFileSize\n CreateDirectoryA\n SleepEx\n WriteFile\n CopyFileA\n DeleteFileW\n GetProcAddress\n GetStartupInfoA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"iCLS.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/65 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/65 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%APPDATA%\\Intel\\iCLS.exe\" (Handle: 120)\n \"\" wrote 52 bytes to a remote process \"%APPDATA%\\Intel\\iCLS.exe\" (Handle: 120)\n \"\" wrote 4 bytes to a remote process \"%APPDATA%\\Intel\\iCLS.exe\" (Handle: 120)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59c270817ca3e10a5745d843","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ursu","contacted_countries":["GBR","USA"],"submit_name":"iconpack.ico","analysis_start_time":"2017-09-20T14:41:30+00:00","indicators_count":{"informative":9,"suspicious":10,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.49.68.192","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"address":"216.146.38.70","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}],"dns_resolutions":[{"domain":"checkip.dyndns.org","address":"216.146.38.70","country":"United States","registrar_name":"Tucows Inc.","registrar_organization":"Dynamic Network Services, Inc.","registrar_name_servers":"NS2.DYNDNS.ORG","registrar_creation_date":"1998-11-22T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"216.146.38.70:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: checkip.dyndns.org","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}],"processes":[{"pid":3660,"ppid":0,"name":"453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba.exe","command_line":"","sha256":"453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba","normalized_path":"C:\\453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba.exe","uid":"00014399-00003660","icon":"$27"},{"pid":2860,"ppid":3660,"name":"cmd.exe","command_line":"\"/c copy \"%APPDATA%\\Intel\\iCLS.exe+\" \"%APPDATA%\\Intel\\iCLS.exe\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014399-00003660","uid":"00018234-00002860","icon":"$28"},{"pid":2968,"ppid":3660,"name":"iCLS.exe","command_line":"","sha256":"453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba","normalized_path":"%APPDATA%\\Intel\\iCLS.exe","parent_uid":"00014399-00003660","uid":"00018236-00002968","icon":"$29"}],"all_imported_dlls":["advapi32.dll","sechost.dll","msasn1.dll","ole32.dll","cryptbase.dll","psapi.dll","wtsapi32.dll","cmutil.dll","crypt32.dll","uxtheme.dll","dnsapi.dll","winnsi.dll","msvcrt.dll","atl.dll","winbrand.dll","clbcatq.dll","oleaut32.dll","mswsock.dll","msctf.dll","rpcss.dll","NapiNSP.dll","rpcrt4.dll","version.dll","ctl3d32.dll","imm32.dll","shlwapi.dll","nsi.dll","kernel32.dll","gdi32.dll","usp10.dll","comctl32.dll","apphelp.dll","dwmapi.dll","pnrpnsp.dll","user32.dll","lpk.dll","rastls.dll","shell32.dll","FWPUCLNT.DLL","WSHTCPIP.DLL","IPHLPAPI.DLL","ntdll.dll","cmpbk32.dll","ws2_32.dll","nlaapi.dll","winrnr.dll","rasadhlp.dll","KernelBase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"iCLS.exe","sha256":"453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"name":"20-09-2017","sha256":"b0bbbb6fc15dd4cff8b0c97889b12f3783bf51675a446db5fff04cce47911cfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"name":"default.conf","sha256":"57b1969302b22dbe7fdad4ca293815c8a7a935286a8187c22ff0e36cef37e524","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}],"files_written":[{"path":"%APPDATA%\\Intel","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"C:\\453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba.exe","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%APPDATA%\\Intel\\iCLS.exe","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%APPDATA%\\Intel\\Logs","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"path":"%APPDATA%\\Intel\\Logs\\20-09-2017","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59c270817ca3e10a5745d843"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["59c270817ca3e10a5745d843"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample 453cf7c56790… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 453cf7c56790…. Malware family: Malware. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 453cf7c56790… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 453cf7c56790…. Malware family: Malware. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/453cf7c567906715ac1e59d221cb671d6caf75fd399583cc8978cab8b6b20aba"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 453cf7c56790… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 453cf7c56790…. Malware family: Malware. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]